[shaicoleman]

Related: TripleCross - A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.

https://github.com/h3xduck/TripleCross

[citronneur]

You have also https://github.com/pathtofile/bad-bpf or https://github.com/Gui774ume/ebpfkit which are good references also

[kerng]

Embrace the red also has a couple of good write ups to learn Offensive eBPF:

https://embracethered.com/blog/posts/2021/offensive-bpf/